From: Greg Kroah-Hartman Date: Mon, 14 Oct 2024 12:08:05 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v5.10.227~37 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ab817f6ea7213f08994b1a5d06f946dbd1b256e6;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: net-fix-an-unsafe-loop-on-the-list.patch --- diff --git a/queue-4.19/net-fix-an-unsafe-loop-on-the-list.patch b/queue-4.19/net-fix-an-unsafe-loop-on-the-list.patch new file mode 100644 index 00000000000..d53e6db4453 --- /dev/null +++ b/queue-4.19/net-fix-an-unsafe-loop-on-the-list.patch @@ -0,0 +1,60 @@ +From 1dae9f1187189bc09ff6d25ca97ead711f7e26f9 Mon Sep 17 00:00:00 2001 +From: Anastasia Kovaleva +Date: Thu, 3 Oct 2024 13:44:31 +0300 +Subject: net: Fix an unsafe loop on the list + +From: Anastasia Kovaleva + +commit 1dae9f1187189bc09ff6d25ca97ead711f7e26f9 upstream. + +The kernel may crash when deleting a genetlink family if there are still +listeners for that family: + +Oops: Kernel access of bad area, sig: 11 [#1] + ... + NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0 + LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0 + Call Trace: +__netlink_clear_multicast_users+0x74/0xc0 +genl_unregister_family+0xd4/0x2d0 + +Change the unsafe loop on the list to a safe one, because inside the +loop there is an element removal from this list. + +Fixes: b8273570f802 ("genetlink: fix netns vs. netlink table locking (2)") +Cc: stable@vger.kernel.org +Signed-off-by: Anastasia Kovaleva +Reviewed-by: Dmitry Bogdanov +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20241003104431.12391-1-a.kovaleva@yadro.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/net/sock.h | 2 ++ + net/netlink/af_netlink.c | 3 ++- + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -764,6 +764,8 @@ static inline void sk_add_bind_node(stru + hlist_for_each_entry_safe(__sk, tmp, list, sk_node) + #define sk_for_each_bound(__sk, list) \ + hlist_for_each_entry(__sk, list, sk_bind_node) ++#define sk_for_each_bound_safe(__sk, tmp, list) \ ++ hlist_for_each_entry_safe(__sk, tmp, list, sk_bind_node) + + /** + * sk_for_each_entry_offset_rcu - iterate over a list at a given struct offset +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -2145,8 +2145,9 @@ void __netlink_clear_multicast_users(str + { + struct sock *sk; + struct netlink_table *tbl = &nl_table[ksk->sk_protocol]; ++ struct hlist_node *tmp; + +- sk_for_each_bound(sk, &tbl->mc_list) ++ sk_for_each_bound_safe(sk, tmp, &tbl->mc_list) + netlink_update_socket_mc(nlk_sk(sk), group, 0); + } + diff --git a/queue-4.19/series b/queue-4.19/series index 160d05b030f..d2482fdfd89 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -265,3 +265,4 @@ hid-plantronics-workaround-for-an-unexcepted-opposite-volume-key.patch revert-usb-yurex-replace-snprintf-with-the-safer-scnprintf-variant.patch usb-xhci-fix-problem-with-xhci-resume-from-suspend.patch usb-storage-ignore-bogus-device-raised-by-jieli-br21-usb-sound-chip.patch +net-fix-an-unsafe-loop-on-the-list.patch